# CVE-2026-108562: Revive Adserver stored cross-site scripting in maintenance page

Source: https://junglewise.ai/threats/cve-2026-108562-a-stored-cross-site-scripting-vulnerability-in-maintenance  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-108562 · Severity: medium · CVSS 5.4 · Published 2026-11-11

Revive Adserver is an open-source ad server that manages digital advertising campaigns. A stored cross-site scripting vulnerability allows an authenticated manager to inject malicious code that executes in administrators' browsers when they view maintenance results, potentially enabling account takeover or unauthorized administrative actions.

Technologies: [Revive-Adserver Revive Adserver](https://junglewise.ai/threats/technologies/adserver). Vendors: [Revive-Adserver](https://junglewise.ai/threats/vendors/revive-adserver).

## Quick answers

**Is CVE-2026-108562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108562 being exploited in the wild.

**How severe is CVE-2026-108562?** Medium severity, with a CVSS score of 5.4, published 11 November 2026.

**Which products and versions are affected?** Revive-Adserver Revive Adserver 6.0.8 and earlier.

**Is there a fix for CVE-2026-108562?** Yes: fixed in Revive Adserver 6.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108562 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108562?** Check whether you run Revive-Adserver Revive Adserver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Revive Adserver 6.0.9

## Technical details

A stored XSS vulnerability exists in maintenance-appendcode-check.php where tracker names are not properly HTML-encoded before display in maintenance results. An authenticated manager can store a malicious tracker name that executes arbitrary JavaScript in an administrator's browser when the maintenance page is accessed. The fix in version 6.0.9 applies HTML-encoding to tracker names during display.

## Affected products

- Revive Adserver Revive Adserver 6.0.8 and earlier

## Timeline

- 2026-11-11: disclosed

## References

- [https://hackerone.com/reports/3826207](https://hackerone.com/reports/3826207)

## Related threats

- [Revive Adserver reflected cross-site scripting in iframe invocation](https://junglewise.ai/threats/cve-2026-108559-a-reflected-cross-site-scripting-vulnerability-in-the-iframe)
- [Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.](https://junglewise.ai/threats/cve-2025-55124-improper-neutralisation-of-input-in-revive-adserver-6-0-0-causes)
- [Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be…](https://junglewise.ai/threats/cve-2025-55123-improper-neutralization-of-input-in-revive-adserver-5-5-2-and-6-0)
- [Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions…](https://junglewise.ai/threats/cve-2025-52671-debug-information-disclosure-in-the-sql-error-message-to-in)
- [SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted…](https://junglewise.ai/threats/cve-2025-52664-sql-injection-in-revive-adserver-6-0-0-causes-potential)